Entangled-state cryptographic protocol that remains secure even if nonlocal hidden 
variables exist and can be measured with arbitrary precision 
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Standard quantum cryptographic protocols are not secure if one assumes that nonlocal hidden 
variables exist and can be measured with arbitrary precision. The security can be restored if one of 
the communicating parties randomly switches between two standard protocols. 
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PACS numbers: 03.67.Dd, 03.65.Ud, 03.65.Ta 

It is known that quantum mechanics can be without 
difficulty replaced by a nonlocal hidden-variable theory 
[1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13]. Simultaneously, 
it is a rather popular belief that an exact knowledge of 
nonlocal hidden variables would destroy security of quan- 
tum cryptography. In this note we do not want to get 
into the crossfire of the discussion if such exact knowl- 
edge is possible or not in a hidden- variable theory that is 
exactly equivalent to standard quantum mechanics. Per- 
haps, the problem we discuss is present only in theories 
that are 'infinitesimally close' to quantum mechanics. We 
are not experts in nonlocal hidden variables and, keeping 
in mind that impossibility proofs may only prove our lack 
of imagination, prefer to assume the worst possible sce- 
nario: Nonlocal hidden variables exist and can be exactly 
known to our enemies. We harness the nonlocality as a 
means of protection by a simple modification of a quan- 
tum protocol. The idea is illustrated on nonrelativistic 
Bohm theory, but one can argue that the effect is typical 
of all nonlocal hidden- variable theories. 

Bohm's theory in its simplest nonrelativistic version [1] 
involves nonlocal hidden variables qj{xi, . . . ,Xn,t) that 
have a meaning of trajectories. The Schrodinger equa- 
tion for an n-particle wave function ■0(a;i, . . . , a;„, t) is 
related by the rule = Rex-p{iS/h) to the system of 
partial differential equations involving Hamilton- Jacobi 
and continuity equations 

dS/dt + J2'^=imjv]/2 + Q + V = 0, (1) 
dp/dt + j:]W^,{pv,) = 0. (2) 

p = is the density of particles, Vj — ^jS/nij the ve- 
locity if a j-th particle, V — V{xi, . . . ,Xn,t) the usual 
potential, and Q = — X]j=i is the so- 

called quantum potential. The hidden trajectories are 
found by integrating the 'guidance equation' dqj/dt = 
Vj. If the particles are not entangled (and thus not in- 
teracting via V), that is the wave fuction takes the prod- 
uct form ip{xi, . . . , Xn, t) = '0i(a;i, t) . . . ■(/'„(a;„, i), then 
Q = YTj=i Qj where Qj = -h'^V]Rj/{2mjRj). Such 
particles cannot communicate via the quantum poten- 
tial. However, for entangled states the particles do in- 
teract via Q even if in the sense of V they are uninter- 



acting. Systems described by entangled states are thus 
nonlocal: The dynamics of a fc-th particle depends on 
what happens to the remaining n — 1 particles. What 
is important, the influences remain within the entangled 
system. The quantum potential is a useful conceptual 
tool in this context, but the Bohm theory needs only the 
Schrodinger and guidance equations. 

An eavesdropper (Eve) attempting to read the secret 
code via the quantum potential would have to get entan- 
gled (in the quantum sense) with the information chan- 
nel and would be detected by the usual means, say, an 
Ekert-type procedure [14, 15]. If the eavesdropper does 
not get entangled, the quantum potential will not carry 
the information she needs. 

Let us now assume that Eve can know the hidden tra- 
jectory q{t) of the particle carrying the key between the 
two communicating parties. A Bohmian analysis of spin- 
1/2 measurements performed via Stern-Gerlach devices 
[4, 5] shows that the knowledge of q{to) at some initial 
time to uniquely determines the results of future mea- 
surements of spin in any direction ([5], pp. 412-415). 
The single-particle schemes of the BB84 variety [16] are 
thus clearly insecure from this perspective. To make mat- 
ters worse, a similar statement can be deduced from the 
analysis of two-electron singlet states described in detail 
in Chapter 11 of [5]. If two Stern-Gerlach devices are 
aligned along the same direction (0,0, 1) and the parti- 
cles propagate toward the Stern-Gerlach devices of Al- 
ice and Bob with velocities Vi = (0, — |vi|,0) and V2 — 
(0, |t>2|,0), respectively, then the results of spin measure- 
ments are always opposite (that is why we use them for 
generating the key) but are uniquely determined by the 
sign of zi{to) — Z2{to), where the respective trajectories 
are qi{t) = {0,yi{t), zi{t)) and q2{t) = {0,y2{t), Z2{t)) 
(cf. the discussion on p. 470 in [5]). The result agrees 
with the analysis of [6] . 

Still, if one looks more closely at the derivation given 
in [5] one notices that the two particles interact with 
identical magnetic fields. We can weaken this assump- 
tion. Following [5] we assume that the time of interac- 
tion with the Stern-Gerlach magnets is T, the particles 
are identical, their magnetic moments and masses equal 
fi and m, and the initial wave functions are Gaussians 
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of half- width cto in the z directions. We also assume 
that Alice's Stern- Gerlach produces the field = 
(0, 0, Bq-\-Bz\) but, contrary to [5], the Bob field is taken 
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where e(i) = f -I- , . The above formulas differ from 

Eqs. (11.12.15), (11.12.16) found in [5] only by the pres- 
ence of K. This apparently innocent generalization has 
a fundamental meaning for the quantum protocol. For 
reasons that are identical to those discussed by Holland 
in his book the signs of spin found in the labs of Alice and 
Bob depend on the sign of the term under tanh. How- 
ever, as opposed to the case of identical magnetic fields 
this sign is controlled not only by the initial values of 
z\{tQ) and -22(^0), in principle known to Eve, but also by 
the parameter k which is known only to Bob. If |k| ^ 1 
then the sign of this term is practically controlled by the 
sign of k; (recall that the range of z\ is limited by the 
size of the Gaussian). Choosing the sign of k randomly, 
Bob can flip the spin of the particle which is already in 
the lab of Alice and is beyond the control of Eve. Eve 
knows, by looking at 2:1 (to) and -22(^0)) what will be the 
result of Alice's measurement if sign(K) = +1, and that 
if sign(K) = — 1 the result will be opposite. But she does 
not know this sign if Bob keeps it secret! It follows that 
she gains nothing by watching the trajectory. But Bob 
always knows the result of Alice's measurement due to 
the EPR correlations. If he keeps k > then Alice got 
the result opposite to what he found in his lab because 
Bi and B2 are parallel; if he takes k < then both Alice 
and Bob find the same number because Bi and B2 are 
anti-parallel. And this is sufficient for producing the key. 
Let us finally clarify here one point that can be easily 
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as -82(^2) = k(0, 0, Bq + BZ2), where k is a real number 
(in [5] K = 1). Then the velocities in the z direction 
(0, 0, 1) read 
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misunderstood at a first reading of our protocol. In the 
Ekert protocol we have four settings of experimental de- 
vices that are used for testing the Bell inequality: {A, B), 
{A,B'), {A',B), {A',B'). This part of the data cannot 
be used for producing the key. We need one more setting, 
say (C; C); that will be used for the key. In our protocol 
we have in addition the setting (C, — C). One can even 
think of our protocol as a version of the Ekert one but 
with two alternative measurements corresponding to the 
same observable. 

What is important, from the hidden- variable point of 
view we can predict what will be the results (for each pair 
of particles) of (C, C) and (C, — C) measurements. If the 
initial hidden variables are such that the results of the 
measurement of (C, C) would yield, say, (C, C) = (+, — ) 
then a result of (C, — C) is not (C, — C) = (+, +), as one 
might naively expect, but (C, — C) = (— , — ). It is the bit 
of Bob that does not change even though it is Bob who 
flips his device! This is how the nonlocality works and 
why Eve does not know the key. 
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